Identity and Access Management (IAM) Advisory

Identity and access management (IAM) decides who can reach your systems and data, and how sure you are that they are who they say they are. Many breaches start with an identity: a reused password, an account that should have been disabled, or an administrator login with no second factor. SSC helps Australian and New Zealand organisations assess, design and uplift IAM controls so they stand up to attackers and to auditors.

What our IAM advisory covers

• IAM maturity assessment. We review your directories, single sign-on, authentication methods, privileged accounts and access review evidence, and rate them against ISO/IEC 27001:2022 Annex A (controls 5.15 to 5.18, 8.2 and 8.5) and the Essential Eight.
• Joiner, mover and leaver process. Clear triggers from HR, role-based access, and removal of access on the day someone leaves.
• Privileged access management. Separate administrator accounts, just-in-time elevation, break-glass procedures and logging of privileged activity.
• Multi-factor authentication roadmap. Moving staff, remote access and administrators to phishing-resistant MFA such as security keys, passkeys or Windows Hello for Business.
• Access reviews. A review cycle that application owners can actually complete, with evidence an auditor will accept.
• Policies and standards. Access control policy, authentication standard and service account rules written to fit how you operate.

Why identity is one of the first controls auditors test

Identity controls appear in almost every framework our clients answer to. Two of the eight Essential Eight strategies are restricting administrative privileges and multi-factor authentication, and the November 2023 update to the maturity model added phishing-resistant MFA requirements. PCI DSS v4.0.1 Requirement 8 requires MFA for all access into the cardholder data environment. For APRA-regulated entities, CPS 234 expects information security controls that match the threats you face, and compromised credentials are among the most common of those threats.

How an engagement runs

1. Discover. Workshops with IT, HR and application owners, and a review of directory, SSO and privileged access configuration.
2. Assess. Gaps rated by risk and mapped to ISO 27001, the Essential Eight and any sector rules that apply to you.
3. Roadmap. A sequenced uplift plan, quick wins first, with effort estimates your team can plan around.
4. Uplift support. We work with your IT team or managed service provider while changes go in, and help collect the evidence.

Related services

IAM work often runs alongside Essential Eight compliance, ISO 27001 implementation and a zero trust program. If you store or process card data, see our PCI DSS compliance advisory.